What is GHSA-vxf2-7rc3-pxmx?

GHSA-vxf2-7rc3-pxmx is a security advisory published by GitHub Security Advisories with High severity. Cheetah Path Search Order Hijacking

Which CVE IDs does GHSA-vxf2-7rc3-pxmx cover?

GHSA-vxf2-7rc3-pxmx covers the following CVE IDs: CVE-2005-1632. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-vxf2-7rc3-pxmx?

GHSA-vxf2-7rc3-pxmx affects 1 product, including: pip/cheetah:\u003e= 0.9.15, \u003c= 0.9.16.

GHSA-vxf2-7rc3-pxmxHigh

Cheetah Path Search Order Hijacking

Vendor

GitHub Security Advisories

Published

May 1, 2022

Last Modified

September 18, 2023

🔗 CVE IDs covered (1)

CVE-2005-1632 →

📋 Description

Cheetah 0.9.15 and 0.9.16 searches the /tmp directory for modules before using the paths in the PYTHONPATH variable, which allows local users to execute arbitrary code via a malicious module in /tmp/.

🎯 Affected products1

pip/cheetah:>= 0.9.15, <= 0.9.16

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2005-1632
https://github.com/cheetahtemplate/cheetah
https://web.archive.org/web/20050430021153/http://sourceforge.net/mailarchive/forum.php?thread_id=7070332&forum_id=1542
https://github.com/advisories/GHSA-vxf2-7rc3-pxmx